All Entries in the "Articles" Category

There is a new vulnerability affecting popular WordPress plugin Yoast. If you’re using the plugin, update it to the most recent version to protect you and your customers from attack.

What is Yoast, and what is the vulnerability?
Yoast is an SEO plugin for WordPress. Versions of the plugin prior to 1.7.3.3 are vulnerable to a blind SQL injection attack, which can lead to a database breach and exposure of confidential information.

What do you need to do to protect your website?
If you’re using Yoast, upgrade to the latest version (1.7.4). Make sure you regularly back up your site to prevent irreparable damage from attacks, take advantage of WordPress’s automated updating of plugins and themes and avoid WordPress plugins that don’t allow for auto-updating.

“Thousands of games, millions of users. Everything you love about Steam. Available soon as a free operating system designed for the TV and the living room.”

For a long time I was wondering why the big development companies focused on creating games haven’t adopted any Linux distribution and based on it to create “THE GAME OS” – where the ‘main’ purpose of the OS is gaming, but you’ll have the benefit to take the advantage of using common Linux software. It seams something like this is going to happen! Recently Steam announced SteramOS . It will be the new home of “All Steam games you like“, “In-home Streaming“, “Music, TV, Movies” etc. More information on the official page: http://store.steampowered.com/livingroom/SteamOS/

CentOS has joined forces with Red Hat! As per officially announced at: http://lists.centos.org/pipermail/centos-announce/2014-January/020100.html – some of the core members: Karanbir Singh, Johnny Hughes Jr, Jim Perrin and Fabian Arrotin are moving to Red Hat. Someone may say that the money already started raining as mirrored in the new look of www.centos.org. Here are some of the statements:

” Some of the key things that are changing:– – Some of us now work for Red Hat, but not RHEL. This should not haveany impact to our ability to do what we have done in the past, itshould facilitate a more rapid pace of development and evolution forour work on the community platform.

– – Red Hat is offering to sponsor some of the buildsystem and initialcontent delivery resources – how we are able to consume these and whenwe are able to make use of this is to be decided.

— The changes we make are going to be community inclusive, and promoted,proposed, formalised, and actioned in an open community centric manneron the centos-devel mailing list. And I highly encourage everyone tocome along and participate.”

Maybe they are not ling but still the question is: “Now, where does CentOS stand in the money tree?”

Starting on the 1st of January 2014, all domain Registrars will ask every Registrants to verify their ownership through email via the Registrant Email Verification process. When an unverified Registrant contact is used to register a domain name, an email will be sent to the Registrant’s email address. The receiver will have up to 15 days to respond to that email after which, their domain name will be suspended. This regulation was approved on 27th. June 2013, by the ICANN board and any registrars that fail comply will risk having their agreement revoked by ICANN.

The Registrant first name, last name, and email details of the Registrant contact will be used to validate a Registrant contact. Changes to any one of those three data will trigger the Registrant Email Verification process when the contact is used to register a new domain name. If the verification is not completed within 15 days, on day 16th day DomainPeople will update the DNS to DomainPeople’s and the domain/s will resolve to a suspended verification page.

Also the Registrant Email Verifications Process will only be applicable to generic Top Level Domains per ICANN requirements. For exmaple: .com .net .pro but not .ca .us domains.

Here is an example lifespan of the registratnt email verification process:

This is an announcement for the launch of Microsoft Windows Server 2012 Release Candidate (RC), the next release of Windows Server. Windows Server 2012 RC delivers a highly dynamic, available, and cost-effective server platform for private clouds. It offers businesses a scalable, dynamic, and multitenant-aware cloud infrastructure that securely connects across premises and allows IT to respond to business needs faster and more efficiently.

Microsoft offers a common set of tools and services that provide these capabilities, all of which either are found in Windows Server 2012 or easily integrate with it. When combined with a set of management tools, such as System Center 2012, Windows Server 2012 offers a complete private cloud solution. Windows Server 2012 provides the platform functionality that manages the physical servers, networking, and storage access, and enables the management layer built on top of it to expose these as a pool of compute, network, and storage resources.

Key Areas of Improvement Include:

Applications and Websites: Windows Server 2012 has multiple features that enable mission critical applications, improve website density and efficiency, and increase scalability and elasticity for multi-tenant enabled applications. It also enhances support for open standards, open source applications, and various development languages.

Network Virtualization: The Hyper-V Replica functionality of Windows Server 2012 allows migration and placement of virtualized workloads, including from on-premises to a hoster in the cloud, without regard to underlying physical network topology.

Manageability: Windows Server 2012 offers a multi-machine management experience, providing the customer with a cohesive view of their servers and roles.

Storage: Windows Server 2012 offers continuous availability ‘“ if a cloud component fails, there is no blackout period, no service interruption and no lost data.

Tags

Last 2011 World IPv6 Day was on June 8th and it was huge step forward for implementing IPv6 globally in Internet. It was involving websites and Internet service providers around the world, including Limelight Networks, Akamai, Facebook, Yahoo! and many more coming together to populate and enable IPv6 for their products.

This year 6 June 2012 will be the IPv6 World Day. Major ISPs, networking equipment manufacturers, web companies, and many more involved into the Internet industry will permanently enable IPv6 in their services.
Many participating websites in World IPv6 Day will join the global trial of the new protocol, IPv6. 24 hours event will demonstrate how the companies are prepared to move to IPv6-enabled Internet. If you wan to join the launch you can visits http://www.worldipv6launch.org/ , and do not forget to test your IPv6 connectivity at http://test-ipv6.com/.

Microsoft posted new security bulletin MS12-035:http://technet.microsoft.com/en-us/security/bulletin/ms12-035
Reporting vulnerabilities in Windows, Office, Silverlight and the .NET Framework. Three critical patches from May 08, 2012 are patching some large security breaches.
The .NET is remote code vulnerability, and the patch should be applied asap.

Yup, as per the title – Parallels alert about new exploit on Plesk linux versions 9.0-9.23. This is just an announce so I will be short.

The PHP Group issued a vulnerability alert that PHP-CGI-based setups contain vulnerability when parsing query string parameters from PHP files. PHP CGI Advisory You can find more information at the PHP‘s website. A remote unauthenticated attacker could obtain sensitive information, cause a denial of service condition or may be able to execute arbitrary code with the privileges of the web server. As per the Parallels Plesk Lifecycle Policy, these versions do not provide ongoing patch support. Upgrade to the latest version of Parallels Plesk Panel will eliminate this vulnerability.

Recently Microsoft released a patch for a critical bug in RDP (Remote Desktop) that may allow an unauthenticated attacker to take control to remote Windows system. This vulnerability in Remote Desktop (MS12-020) could allow Remote Code execution allowing system penetration.It rated Critical for all supported releases of Microsoft Windows.

All windows servers with automatic updates enabled should have received the patch at March 13th 2012, but if your system has the automatic updates turned off, the issue still persist.
With the bellow commands executed in command prompt you can check if the security patch is applied already:

Shell

1

2

3

C:\>wuaucpl.cpl

C:\>start wuauclt/showoptions

C:\>wmic qfe list full/format:csv|find"KB2621440"

The security update addresses the vulnerabilities by modifying the way that the Remote Desktop Protocol processes packets in memory and the way that the RDP service processes packets.

Here is maybe the point where I will say that if you change Windows Remote Desktop Port number will increase your security level – at least when the system is scanned with automated bot looking for the default 3389 port.

For a first time I saw Plesk before about 6-7 years when ordered one of my first servers with control panel. To be honest till version 8.6 I was not so exited, but with that version and above it became pretty stable, and I started liking it more and more.
Unfortunately couple of days ago over Internet was spread there was found critical vulnerability in Plesk versions 7.6.1(my first one) to 10.3.1 one of the latest. Well, it is nice to realise your servers had been exposed for such long time, and such security hole was kept secret until penetration of two servers hosting websites for the Federal Trade Commission (Plesk control panel bug…) instead of thousands maybe not so important servers.

Well, in short the issue is critical, it is network exploitable, and it is rather easy the server to be compromised – in other words every second wannabe hacker can penetrate your server. There is no need of authentication to be exploited, and it allows unauthorized access and modification on a server level. Vulnerable Plesk Panel versions are: 7.6.1 – 10.3.1

Pretty bad ha?

Because this Plesk vulnerability the hacker to make changes to the user accounts, files, and sites – even after patches are applied he may still have access to sites.If you have even a small doubt your sever was compromised before you applied the patches, it is strongly recommended to change passwords of all accounts in Plesk!

So, if you have server with Plesk it is required to check if it is up-to-date, and you will need the following information: